How are scammers impersonating the Canadian ccTLD?

A high-trust domain

The Canadian country code Top Level Domain (ccTLD) is currently 9th best in the GSE league tables, meaning it is not commonly abused by scammers (only 1 in 567 .ca domain names end up in the GSE). One likely contributing factor is the robust registration requirements from the Canadian Internet Registration Authority (CIRA). Registering a .ca domain requires proving a legitimate legal connection to Canada (such as being a Canadian citizen, permanent resident, corporation, or trademark owner). Even though scammers may provide false details, CIRA actively audits and verifies registrant documents to avoid this.

When scammers borrow .ca’s reputation

TLD mimicry or spoofing is an effective tactic used by scammers to benefit from the hard-earned trust of TLDs without having to actually use them. TLD mimicry is less common than other trust-gaining tactics scammers rely on, such as impersonating brands and entities or using specific languages. But it matters because it exploits the very structures that underpin the domain name system.

Our previous research using LLM-scaled analysis of the geography of scam targets showed that scammers are more likely to attempt to spoof countries’ ccTLDs which perform better in the league tables. Through this, we find the .ca TLD is the 4th most spoofed in the first 6 months of this year.

As part of a new research and development focus on digital forensics, the team are using the repetitive behaviour of scammers’ to their advantage. Through continuing to explore the notion of ‘scam corridors’, they can uncover clusters of scams which are very likely to have originated from the same place.

One corridor, consisting of 448 signals, stood out. The key features were:

• Top Level Domain: .xin,
• Domain name registrants from China,
• Cloudflare Autonomous System Number,
• Regional internet registry prefix country: US,
• Canadian targets:
  • 62% spoofed Purolator Inc., a Canadian integrated freight, parcel and logistics company majority owned by Canada Post.
  • Other signals spoofed Canadian telecoms and other logistics companies.
  • 92% of signals contained the string ‘/ca-’.

Examples of signals in this cluster are:

• puralatar.mobile-kot.xin/ca-redelivery-authentication/
• ca-gov.mobile-vkw.xin/ca/
• intelcom.815304.xin/ca-redelivery-authentication

There are multiple victims getting caught in the crossfire of scams, not only people targeted. The registries that manage high-trust ccTLDs have put in significant efforts to minimise the number of scam reports from their legitimate infrastructure, but scammers can still borrow their brand without ever registering a domain. Protecting the trust placed in any TLD therefore means looking beyond registration policy. However, without protecting their brand from impersonation, these efforts are undermined.

Similarly, logistics and delivery companies face similar problems as scammers are known to exploit the high-frequency communications characteristic of these sectors. Both groups stand to gain from engaging in cross-sector data sharing to build up intelligence and understand abuse patterns. The more data is accumulated, the more identifiable these clusters of abuse become, and the more likely they are to be disrupted.